Hippeus ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)

17 March 2021

Suspected sockpuppets

• 11Fox11 ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)

• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Evidence as follows:

• Mostly automated edits: Hippeus 72.5% automated, with only 488 manual vs. 11Fox11 80.8% automated, with only 360 manual
• Hippeus's timecard shows almost all edits always in a surprisingly short 4 hour timespan (1000-1400 UTC), which is one of two time slots in which 11Fox11 does not edit (the other is 2100-0200).
• Despite the having only about 400 manual edits each, they have supported each other in a variety of diverse areas. Also worth noting that despite being new editors they are both expert users of the various noticeboards:

1. Gilad Atzmon reverted equivalent edits a few days apart [1] and [2] and related talk page comments
2. User:Jontel warned with threats [3] and [4]
3. User:DavidBena topic ban removal vote [5] and [6]
4. West Bank bantustans AfD vote [7] and [8]
5. 1990 Temple Mount riots RM vote [9] and [10]
6. RSN votes (different topics)
   1. Jewish Chronicle vote [11] and [12]
   2. MEMRI vote [13] and [14]
   3. wafa.ps vote [15] and [16]
   4. The Canary vote [17] and [18]
7. ANI against User:Nableezy vote [19] and [20]
8. EW opening cases against Jontel [21] and [22] and [23]
9. Israel RfC vote [24] and [25]

These nine pages alone make up 47 of 11Fox11's 360 manual edits (13%) and 142 of Hippeus's 488 manual edits (29%).

Onceinawhile ( talk) 08:33, 17 March 2021 (UTC) reply

The comment below from 11Fox11 "and no Hippeus or anyone else sprung up in that fishing expedition!" is oddly worded. Onceinawhile ( talk) 10:02, 17 March 2021 (UTC) reply

@ Oshwah: thank you. Editing style suggests they are very experienced; if the accounts are connected, I would think there is a reasonable chance of sleepers. Would it be possible to run a sleeper check or are the ranges too wide? Onceinawhile ( talk) 22:36, 17 March 2021 (UTC) reply

I have been through both their editing histories. The accounts rarely edit on the same day, and never in the same time period. Always big groups of one edits and then the other. 11 August 2020 is a good example: 0200-0400 11Fox11; 0500-0700 and 1000-1300 Hippeus, 1500-1900 11Fox11.

Strangely Hippeus’s hours changed completely when they reappeared for the Jontel block three weeks ago. The account had not been used since 17 Nov, and awoke on 27 Feb. They have since moved out outside of their normal 1000-1400 window, instead editing in the hours of 1800-1900 and 0300-0400 which are usually frequented by 11Fox11. But still no overlap.

Behaviorally, they both have an interesting habit of regular days where they do the same series of three things in the space of an hour or two: (1) a comment at RSN; (2) vote at some noticeboard or RfC; (3) make a series of automated edits.

Onceinawhile ( talk) 10:05, 18 March 2021 (UTC) reply

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I am too have participated almost in all of these threads. Does it mean that I am anyone sock? Those all hot button issues that attract editors that interested in the conflict. -- Shrike ( talk) 21:37, 17 March 2021 (UTC) reply

Oshwah Do the geolocationis the same country? If both users come from Israel so its natural they edit about the conflict Shrike ( talk) 07:01, 18 March 2021 (UTC) reply

Shrike - The geolocations are from the exact same area. ~Oshwah~ ^{(talk) (contribs)} 15:49, 18 March 2021 (UTC) reply

Oshwah, In Israel all residential ISP/mobile addresses in Israel geolocate to the Tel-Aviv area for example I may edit from Eilat(which in the south) but my IP is from Tel-Aviv because its where the provider is located and have nothing to do with my actual location. Shrike ( talk) 16:07, 18 March 2021 (UTC) reply

Data from IPinfo here seems to suggest the opposite. There is a lot of diversity here; the largest group of IPs are addressed in Netanya and Haifa. Onceinawhile ( talk) 17:03, 18 March 2021 (UTC) reply

Onceinawhile Netaniya its tel-aviv area.There is also major ISP in Petach tikva.Like I said I may live in Beer-Sheva and get geolocated to Haifa Shrike ( talk) 17:20, 18 March 2021 (UTC) reply

I have also checked editing styles of the users there are different for example fox place space after indent mark while hippeus doesn't.There is probably more.-- Shrike ( talk) 07:19, 18 March 2021 (UTC) reply

Comments by 11Fox11

I've seen Hippeus around, mostly at noticeboards and publicized discussions. I did not "threaten" Jontel, I placed a standard uw-defamatory3 warning for this edit (as "Zio" is an ethnic slur). I do spend time patrolling recent changes for vandalism and disruption, but I prefer to use RedWarn.

This report is part of a never ending vendetta by Onceinawhile. Back in January, I reported Onceinawhile to AE, leading to a logged warning. When AE was going against him, he reported me as a NoCal100 sock and this was rejected by CU (and no Hippeus or anyone else sprung up in that fishing expedition!). The report here is on the same level, by the evidence Onceinwhile present they themselves are a sock because they participate on the same boards.

This harassment by Onceinawhile needs to stop. 11Fox11 ( talk) 09:45, 17 March 2021 (UTC) reply

@ Hippeus: I am sorry you got caught up in this harassment too. I just enabled e-mail on my account, but I see yours is disabled. Could you please e-mail me or enable e-mail? I want to discuss what to do with you. 11Fox11 ( talk) 20:27, 19 March 2021 (UTC) reply

Clerk, CheckUser, and/or patrolling admin comments

•  Possible. Same geolocation, different user agents. Ranges are very wide. ~Oshwah~ ^{(talk) (contribs)} 21:24, 17 March 2021 (UTC) reply

• Investigation inconclusive (and stale). Nothing to do here. Closing. – bradv 🍁 00:52, 24 May 2021 (UTC) reply